CVE-2017-6351

{"id": "CVE-2017-6351", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2017-03-06T02:59:00.463", "references": [{"url": "http://www.securityfocus.com/bid/96588", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.wepresentwifi.com/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/41480/", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The WePresent WiPG-1500 device with firmware 1.0.3.7 has a manufacturer account that has a hardcoded username / password. Once the device is set to DEBUG mode, an attacker can connect to the device using the telnet protocol and log into the device with the 'abarco' hardcoded manufacturer account. This account is not documented, nor is the DEBUG feature or the use of telnetd on port tcp/5885."}, {"lang": "es", "value": "El dispositivo WePresent WiPG-1500 con firmware 1.0.3.7 tiene una cuenta de fabricante que tiene un nombre de usuario / contrase\u00f1a codificados. Una vez que el dispositivo est\u00e1 configurado en el modo DEBUG, un atacante puede conectarse al dispositivo usando el protocolo telnet e iniciar sesi\u00f3n en el dispositivo con la cuenta de fabricante codificada \"abarco\". Esta cuenta no est\u00e1 documentada, ni tampoco lo est\u00e1 la caracter\u00edstica DEBUG o el uso de telnetd en puerto tcp/5885."}], "lastModified": "2017-09-01T01:29:36.087", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wepresent:wipg-1500_firmware:1.0.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9667DDE-56BF-4D9D-89B3-BD1A833A66B3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wepresent:wipg-1500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "400D4CC4-30BA-4705-A353-1C48BA1D5E51"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}